My personal belief (which is significantly different from the law on the matter as I understand it) is that "unauthorized access" for computer crimes should require intentional, material deception. That means that they deceived someone (or their computer), that they did so intentionally, and that but-for that deception, access would not have been given.

I do believe that one could argue over whether changing one's MAC address (or IP) constituted that sort of deception. So in all honesty, it's possible that he would still be convicted by a standard like that, though I would like to think that he would not. Intention would seem to be hard to prove, though reasonable minds might differ.

Separately, I think that computer crimes have disproportionate penalties right now. I really don't see any reason why using a computer to steal money (or commit whatever other crime) should merit a greater sentence than stealing the same amount by other means. I am aware that it has been like this for some time, but hackers have had longstanding gripes with this state of affairs, dating back to Morris & Mitnick.